Icegram <= 2.1.7 is vulnerable to Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Contributor

Published
2022-05-31

The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks

CVE

https://www.cve.org/CVERecord?id=CVE-2022-1776

CVSS

Score:5.4

Severity:Medium

Version: 2.1.7

There is a patch available in v2.1.8 and we strongly recommend you update to this version as soon as possible.